diff --git a/AGENTS.md b/AGENTS.md
index 69e4228..5d210bd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -44,6 +44,16 @@ what we take vs. skip). Never vendor it into the build.
 
 ## Gotchas
 
+- **Coolify deployment** (verified 2026-10-25): app `nokzgyrlhuuzduozr7yts4z3`
+  in project Personal, `https://tunnel.tzgyn.dev`, deploy-key source on the
+  shared `gitea` key, push to `main` auto-deploys via the Gitea webhook.
+  Redeploy with `POST /api/v1/deploy?uuid=<app>` (the GET form is gone).
+  This Coolify version stores `custom_labels` **base64-encoded** and does
+  *not* merge its generated Traefik labels for API-created apps: the full
+  label set must live in `custom_labels` (mirror a working app's generated
+  format — http/https routers with `certresolver=letsencrypt` — plus the TCP
+  passthrough lines). Deployment JSON from the API can break `jq` (invalid
+  escapes in the logs field) — parse with python instead.
 - **Deployment**: the multi-stage `Dockerfile` builds a static non-root
   alpine image; verify `CGO_ENABLED=0 go build -trimpath -ldflags="-s -w"
   ./cmd/tunneld` after changing build-affecting code (no Docker runtime on